XOM API for Processing XML with Java

[Elliotte Rusty Harold <elharo AT ibiblio.org>]

It can be done but it's not as easy as it probably should be.

You'd need to start by setting up a SAX XMLReader configured to use a
custom EntityResolver that returns the empty string for all entities you
don't want to load (or just for all entities). Then you pass this to the
XOM Builder constructor.

On Tue, Sep 16, 2014 at 5:06 AM, Mike Wilson <mikewse AT hotmail.com> wrote:

> [resending as subscriber]
>
> Hi,
>
> We are using XOM to communicate XML over the internet and need to protect
> ourselves from XML hacks such as mentioned on:
>  <https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
> >
> https://www.owasp.org/index.php/XML_External_Entity_%28XXE%29_Processing
>
> What is the most straight-forward way to configure XOM to achieve this?
>
> Currently we are just doing:
>     Builder builder = new Builder();
>     Document doc = builder.build(new StringReader(xmlstr));
>
> Thanks
> Mike
> _______________________________________________
> XOM-interest mailing list
> XOM-interest AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/xom-interest
>



-- 
Elliotte Rusty Harold
elharo AT ibiblio.org